@faable/auth-sdk 2.7.83 → 2.7.85

package/dist/api/types.d.ts

@@ -1368,6 +1368,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/organization/{organization_id}/auto-join": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set an Organization's auto-join rules
+         * @description Replaces the auto-join rules: whoever signs in with a verified email of one of the verified domains joins these teams (of this organization) with these roles. Nobody already a member is changed. Pro plan to turn it on; an empty list turns it off and is always allowed.
+         */
+        put: operations["organization/setAutoJoin"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/require-sso": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Require SSO for an Organization
+         * @description On: people of the verified domains reach the organization's teams only through its identity provider. Access tokens carry `https://faable.com/org` (the organization of the user's verified email domain) and `https://faable.com/org_sso` (whether this session came through its identity provider); the resource server applies it. Needs a bound `oidc` connection and the Pro plan; turning it off is always allowed.
+         */
+        put: operations["organization/setRequireSso"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/teammember": {
         parameters: {
             query?: never;
@@ -4946,6 +4986,8 @@ export interface components {
             /** @default null */
             response_type: string;
             enabled: boolean;
+            /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+            organization?: string | null;
             /** @default null */
             enabled_clients: string[] | null;
             /** @default [] */
@@ -5008,6 +5050,10 @@ export interface components {
             client_secret?: string;
             issuer?: string;
             jwks_url?: string;
+            token_url?: string;
+            userinfo_url?: string;
+            /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+            organization?: string;
             scope?: string[];
             enabled?: boolean;
             claims_mapping?: {
@@ -5084,6 +5130,7 @@ export interface components {
             disable_signup?: boolean;
             /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
             login_identifier?: "email" | "username" | "email_or_username";
+            organization?: string | null;
         };
         /** @description Presentation metadata for one connection type. Contains no endpoint URLs and no credentials. */
         ConnectionTypeInfo: {
@@ -5863,6 +5910,15 @@ export interface components {
                  */
                 verified_at: string | null;
             }[];
+            /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+            require_sso: boolean;
+            /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+            auto_join: {
+                /** @description A team of this organization. */
+                team: string;
+                /** @description Role ids the member gets in that team. */
+                roles: string[];
+            }[];
             /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
             admins: string[];
             /** @description Object is related with this account */
@@ -7334,6 +7390,9 @@ export interface components {
          *     - `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.
          *     - `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.
          *     - `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.
+         *     - `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.
+         *     - `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.
+         *     - `organization_has_no_idp` (400): Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.
          *     - `organization_not_found` (404): No organization with that id in this account.
          *     - `invalid_user` (400): The user does not exist in this account.
          *     - `not_an_organization_admin` (404): The user is not an admin of the organization.
@@ -7351,7 +7410,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -9938,6 +9997,10 @@ export interface operations {
                     client_secret?: string;
                     issuer?: string;
                     jwks_url?: string;
+                    token_url?: string;
+                    userinfo_url?: string;
+                    /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                    organization?: string;
                     scope?: string[];
                     enabled?: boolean;
                     claims_mapping?: {
@@ -10006,6 +10069,8 @@ export interface operations {
                         /** @default null */
                         response_type: string;
                         enabled: boolean;
+                        /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                        organization?: string | null;
                         /** @default null */
                         enabled_clients: string[] | null;
                         /** @default [] */
@@ -10177,6 +10242,8 @@ export interface operations {
                         /** @default null */
                         response_type: string;
                         enabled: boolean;
+                        /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                        organization?: string | null;
                         /** @default null */
                         enabled_clients: string[] | null;
                         /** @default [] */
@@ -10361,6 +10428,7 @@ export interface operations {
                     disable_signup?: boolean;
                     /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
                     login_identifier?: "email" | "username" | "email_or_username";
+                    organization?: string | null;
                 };
             };
         };
@@ -10394,6 +10462,8 @@ export interface operations {
                         /** @default null */
                         response_type: string;
                         enabled: boolean;
+                        /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                        organization?: string | null;
                         /** @default null */
                         enabled_clients: string[] | null;
                         /** @default [] */
@@ -10571,6 +10641,8 @@ export interface operations {
                         /** @default null */
                         response_type: string;
                         enabled: boolean;
+                        /** @description The Organization whose identity provider this is (`organization_…`), or `null`. Only `oidc` connections. Reached by home realm discovery from the organization's verified email domains, and only accepts emails of those domains. Pro plan. */
+                        organization?: string | null;
                         /** @default null */
                         enabled_clients: string[] | null;
                         /** @default [] */
@@ -10892,6 +10964,15 @@ export interface operations {
                 content: {
                     "application/json": {
                         ok: boolean;
+                        /** @description The identifier is an email of an organization's verified domain, and that organization has its own identity provider: continue with `/authorize?resume_state=<state>&connection=<connection_id>` instead of the method chooser (arch/auth/sso.md F3). */
+                        home_realm?: {
+                            connection_id: string;
+                            organization: {
+                                id: string;
+                                name: string;
+                                logo_url: string | null;
+                            };
+                        };
                     };
                 };
             };
@@ -19105,6 +19186,15 @@ export interface operations {
                              */
                             verified_at: string | null;
                         }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19253,6 +19343,15 @@ export interface operations {
                              */
                             verified_at: string | null;
                         }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19426,6 +19525,15 @@ export interface operations {
                              */
                             verified_at: string | null;
                         }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19580,6 +19688,15 @@ export interface operations {
                              */
                             verified_at: string | null;
                         }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19742,6 +19859,15 @@ export interface operations {
                              */
                             verified_at: string | null;
                         }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -19895,6 +20021,15 @@ export interface operations {
                              */
                             verified_at: string | null;
                         }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -20067,6 +20202,15 @@ export interface operations {
                              */
                             verified_at: string | null;
                         }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -20224,6 +20368,15 @@ export interface operations {
                                  */
                                 verified_at: string | null;
                             }[];
+                            /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                            require_sso: boolean;
+                            /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                            auto_join: {
+                                /** @description A team of this organization. */
+                                team: string;
+                                /** @description Role ids the member gets in that team. */
+                                roles: string[];
+                            }[];
                             /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                             admins: string[];
                             /** @description Object is related with this account */
@@ -20429,6 +20582,15 @@ export interface operations {
                              */
                             verified_at: string | null;
                         }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
                         /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
                         admins: string[];
                         /** @description Object is related with this account */
@@ -20533,6 +20695,397 @@ export interface operations {
             };
         };
     };
+    "organization/setAutoJoin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    auto_join: {
+                        /** @description A team of this organization. */
+                        team: string;
+                        /** @description Role ids of this tenant. */
+                        roles: string[];
+                    }[];
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `team_not_in_organization` — Auto-join can only put people in teams of the same organization. `details.teams` lists the others.
+             *
+             *     `invalid_role` — The role belongs to another account.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "team_not_in_organization" | "invalid_role" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /** @description `plan_required` — The setting requires a higher plan. `message` says which. */
+            402: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_required";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `role_not_found` — No role with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "role_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+            /** @description `plan_unavailable` — The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_unavailable";
+                    };
+                };
+            };
+        };
+    };
+    "organization/setRequireSso": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    require_sso: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description People of the verified domains reach the organization's teams only through its identity provider. Applied by the resource server with the `https://faable.com/org` and `https://faable.com/org_sso` access-token claims. */
+                        require_sso: boolean;
+                        /** @description Whoever signs in with a verified email of one of the verified domains joins these teams. Empty = nobody joins by domain. */
+                        auto_join: {
+                            /** @description A team of this organization. */
+                            team: string;
+                            /** @description Role ids the member gets in that team. */
+                            roles: string[];
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `organization_has_no_idp` — Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_has_no_idp" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /** @description `plan_required` — The setting requires a higher plan. `message` says which. */
+            402: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_required";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+            /** @description `plan_unavailable` — The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_unavailable";
+                    };
+                };
+            };
+        };
+    };
     "teammember/list": {
         parameters: {
             query?: {